% ASUS Chromebook C201 

This is a Chromebook, using the Rockchip RK3288 SoC. It uses an ARM CPU,
and has free EC firmware (unlike some other laptops). More RK3288-based
laptops will be added to libreboot at a later date.

Paul Kocialkowski, a [Replicant](http://www.replicant.us/) developer,
ported this laptop to libreboot. Thank you, Paul!

**More info will be added later, including build/installation
instructions. The board is supported in libreboot, however, and has been
confirmed to work.**

Flashing instructions can be found at
[../install/\#flashrom](../install/#flashrom)

-   [Google's intent with CrOS devices](#googlesintent)
-   [Considerations about ChromeOS and free operating systems](#os)
-   [Caution: Video acceleration requires a non-free blob, software
    rendering can be used instead.](#videoblobs)
-   [Caution: WiFi requires a non-free blob, a USB dongle can be used
    instead.](#wifiblobs)
-   [EC firmware is free software!](#ec)
-   [No microcode!](#microcode)
-   [Depthcharge payload](#depthcharge)
-   [Flash chip write protection: the screw](#thescrew)

Google's intent with CrOS devices {#googlesintent}
==================================

CrOS (Chromium OS/Chrome OS) devices, such as Chromebooks, were not
designed with the intent of bringing more freedom to users. However,
they run with a lot of free software at the boot software and embedded
controller levels, since free software gives Google enough flexibility
to optimize various aspects such as boot time and most importantly, to
implement the CrOS security system, that involves various aspects of the
software. Google does hire a lot of Coreboot developers, who are
generally friendly to the free software movement and try to be good
members of the free software community, by contributing code back.

CrOS devices are designed (from the factory) to actually coax the user
into using proprietary web services (SaaSS) that invade the user's
privacy (ChromeOS is literally just the Google Chrome browser when you
boot up, itself proprietary and comes with proprietary add-ons like
flash. It's only intended for SaaSS, not actual, real computing).
Google is even a member of the *PRISM* program, as outlined by Edward
Snowden. See notes about ChromeOS below. The libreboot project
recommends that the user replace the default *ChromeOS* with a
distribution that can be used in freedom, without invading the user's
privacy.

We also use a similar argument for the MacBook and the ThinkPads that
are supported in libreboot. Those laptops are supported, in spite of
Apple and Lenovo, companies which are actually *hostile* to the free
software movement.

Considerations about ChromeOS and free operating systems {#os}
========================================================

This laptop comes preinstalled (from the factory) with Google ChromeOS.
This is a GNU+Linux distribution, but it's not general purpose and it
comes with proprietary software. It's designed for SaaSS. Libreboot
recommends that users of this laptop replace it with another
distribution.

Debian GNU+Linux
----------------

<https://wiki.debian.org/InstallingDebianOn/Asus/C201> shows how to
install Debian.

TODO: instructions for Devuan

Caution: Video acceleration requires a non-free blob, software rendering can be used instead. {#videoblobs}
=============================================================================================

The Tamil driver source code for the onboard Mali T GPU is not released.
The developer has so-far withheld it. Until that is released, the only
way to use video (in freedom) on this laptop is to not have video
acceleration, by making sure not to install the relevant blob. Most
tasks can still be performed without video acceleration, without any
noticeable performance penalty.

In practise, this means that certain things like games, blender and
GNOME shell (or other fancy desktops) won't work well. The libreboot
project recommends a lightweight desktop which does not need video
acceleration, such as *XFCE* or *LXDE*.

The Tamil developer wrote this blog post, which sheds light on the
story:
[http://libv.livejournal.com/27461.html,http://libv.livejournal.com/27461.html](http://libv.livejournal.com/27461.html).

Caution: WiFi requires a non-free blob, a USB dongle can be used instead. {#wifiblobs}
=========================================================================

These laptops have non-removeable (soldered on) WiFi chips, which
require non-free firmware in the Linux kernel in order to work.

The libreboot project recommends using an external USB wifi dongle that
works with free software. See
[\#recommended\_wifi](./#recommended_wifi).

There are 2 companies (endorsed by Creative Commons, under their
*Respects your Freedom* guidelines), that sell USB WiFi dongles
guaranteed to work with free software (i.e. linux-libre kernel):

-   [ThinkPenguin sells
    them](https://www.thinkpenguin.com/gnu-linux/penguin-wireless-n-usb-adapter-gnu-linux-tpe-n150usb)
    (company based in USA)
-   [Tehnoetic sells
    them](https://tehnoetic.com/tehnoetic-wireless-adapter-gnu-linux-libre-tet-n150)
    (company based in Europe)

These wifi dongles use the AR9271 (atheros) chipset, supported by the
free *ath9k\_htc* driver in the Linux kernel. They work in *linux-libre*
too.

EC firmware is free software! {#ec}
=============================

It's free software. Google provides the source. Build scripts will be
added later, with EC sources provided in libreboot, and builds of the EC
firmware.

This is unlike the other current libreboot laptops (Intel based). In
practise, you can (if you do without the video/wifi blobs, and replace
ChromeOS with a distribution that respects your freedom) be more free
when using one of these laptops.

The libreboot FAQ briefly describes what an *EC* is:
<http://libreboot.org/faq/#firmware-ec>

No microcode! {#microcode}
=============

Unlike x86 (e.g. Intel/AMD) CPUs, ARM CPUs do not use microcode, not
even built in. On the Intel/AMD based libreboot systems, there is still
microcode in the CPU (not considered problematic by the FSF, provided
that it is reasonably trusted to not be malicious, since it's part of
the hardware and read-only), but we exclude microcode updates (volatile
updates which are uploaded at boot time by the boot firmware, if
present), which are proprietary software.

On ARM CPUs, the instruction set is implemented in circuitry, without
microcode.

Depthcharge payload {#depthcharge}
===================

These systems do not use the GRUB payload. Instead, they use a payload
called depthcharge, which is common on CrOS devices. This is free
software, maintained by Google.

Flash chip write protection: the screw {#thescrew}
======================================

It's next to the flash chip. Unscrew it, and the flash chip is
read-write. Screw it back in, and the flash chip is read-only. It's
called the screw.

*The screw* is accessible by removing other screws and gently prying off
the upper shell, where the flash chip and the screw are then directly
accessible. User flashing from software is possible, without having to
externally re-flash, but the flash chip is SPI (SOIC-8 form factor) so
you can also externally re-flash if you want to. In practise, you only
need to externally re-flash if you brick the laptop; read
[../install/bbb\_setup.html](../install/bbb_setup.html) for an example
of how to set up an SPI programmer.

Write protection is useful, because it prevents the firmware from being
re-flashed by any malicious software that might become executed on your
GNU+Linux system, as root. In other words, it can prevent a
firmware-level *evil maid* attack. It's possible to write protect on
all current libreboot systems, but CrOS devices make it easy. The screw
is such a stupidly simple idea, which all designs should implement.

Copyright © 2015 Leah Rowe <info@minifree.org>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)
% ASUS Chromebook C201 installation guide 

These instructions are for installing Libreboot to the ASUS Chromebook
C201. Since the device ships with Coreboot, the installation
instructions are the same before and after flashing Libreboot for the
first time.

**If you are using libreboot\_src or git, then make sure that you built
the sources first (see [../git/\#build](../git/#build)).**

Look at the [list of ROM images](#rom) to see which image is compatible
with your device.

Libreboot can be installed internally from the device, with sufficient
privileges. The installation process requires using **Google's modified
version of flashrom**, that has support for reflashing the Chromebook's
SPI flash. Otherwise, flashing externally will work with the upstream
flashrom version.

**Google's modified version of flashrom** is free software and its
source code is made available by Google:
[flashrom](https://chromium.googlesource.com/chromiumos/third_party/flashrom/).\
It is not distributed along with Libreboot yet. However, it is
preinstalled on the device, with ChromeOS.

Installing Libreboot internally requires sufficient privileges on the
system installed on the device.\
When the device has ChromeOS installed (as it does initially), it is
necessary to gain root privileges in ChromeOS, to be able to access a
root shell.

-   [Gaining root privileges on ChromeOS](#root_chromeos)
-   [Preparing the device for the installation](#preparing_device)
    -   [Configuring verified boot
        parameters](#configuring_verified_boot_parameters)
    -   [Removing the write protect
        screw](#removing_write_protect_screw)
-   [Installing Libreboot to the SPI flash]()
    -   [Installing Libreboot internally, from the
        device](#installing_libreboot_internally)
    -   [Installing Libreboot externally, with a SPI flash
        programmer](#installing_libreboot_externally)
-   [Debian GNU+Linux is recommended for this device](#debian)

Gaining root privileges on ChromeOS
In order to gain root privileges on ChromeOS, developer mode has to be
enabled from the recovery mode screen and debugging features have to be
enabled in ChromeOS.

Instructions to access the [recovery mode
screen](../depthcharge/#recovery_mode_screen) and [enabling developer
mode](../depthcharge/#enabling_developer_mode) are available on the page
dedicated to [depthcharge](../depthcharge/).

Once developer mode is enabled, the device will boot to the [developer
mode screen](../depthcharge/#developer_mode_screen). ChromeOS can be
booted by waiting for 30 seconds (the delay is shortened in Libreboot)
or by pressing **Ctrl + D**

After the system has booted, root access can be enabled by clicking on
the **Enable debugging features** link. A confirmation dialog will ask
whether to proceed.\
After confirming by clicking **Proceed**, the device will reboot and ask
for the root password to set. Finally, the operation has to be confirmed
by clicking **Enable**.

After setting the root password, it becomes possible to log-in as root.
A tty prompt can be obtained by pressing **Ctrl + Alt + Next**. The
**Next** key is the one on the top left of the keyboard.

Preparing the device for the installation
Before installing Libreboot on the device, both its software and
hardware has to be prepared to allow the installation procedure and to
ensure that security features don't get in the way.

Configuring verified boot parameters {#configuring_verified_boot_parameters}
------------------------------------

It is recommended to have access to the [developer mode
screen](../depthcharge/#developer_mode_screen) and to [configure the
following verified boot
parameters](../depthcharge/#configuring_verified_boot_parameters):

-   Kernels signature verification: *disabled*
-   External media boot: *enabled*

Those changes can be reverted later, when the device is known to be in a
working state.

Removing the write protect screw {#removing_write_protect_screw}
--------------------------------

Since part of the SPI flash is write-protected by a screw, it is
necessary to remove the screw to remove the write protection and allow
writing Libreboot to the *read-only* part of the flash.

To access the screw, the device has to be opened. There are 8 screws to
remove from the bottom of the device, as shown on the picture below. Two
are hidden under the top pads. After removing the screws, the keyboard
plastic part can be carefully detached from the rest. **Beware: there
are cables attached to it!** It is advised to flip the keyboard plastic
part over, as shown on the picture below. The write protect screw is
located next to the SPI flash chip, circled in red in the picture below.
It has to be removed.

[![Screws](images/c201/screws.jpg)](images/c201/screws.jpg) [![WP
screw](images/c201/wp-screw.jpg)](images/c201/wp-screw.jpg)

The write protect screw can be put back in place later, when the device
is known to be in a working state.

Installing Libreboot to the SPI flash {#installing_libreboot_spi_flash}
=====================================

The SPI flash (that holds Libreboot) is divided into various partitions
that are used to implement parts of the CrOS security system. Libreboot
is installed in the *read-only* coreboot partition, that becomes
writable after removing the write-protect screw.

Installing Libreboot internally, from the device {#installing_libreboot_internally}
------------------------------------------------

Before installing Libreboot to the SPI flash internally, the device has
to be reassembled.

All the files from the **veyron\_speedy** release (or build) have to be
transferred to the device.

The following operations have to be executed with root privileges on the
device (e.g. using the *root* account). In addition, the
**cros-flash-replace** script has to be made executable:
    # chmod a+x cros-flash-replace

The SPI flash has to be read first:
    # flashrom -p host -r flash.img\
**Note: it might be a good idea to copy the produced flash.img file at
this point and store it outside of the device for backup purposes.**

Then, the **cros-flash-replace** script has to be executed as such:

    # ./cros-flash-replace flash.img coreboot ro-frid
If any error is shown, it is definitely a bad idea to go further than
this point.

The resulting flash image can then be flashed back:

    # flashrom -p host -w flash.img

You should also see within the output the following:\
**"Verifying flash\... VERIFIED."**

Shut down. The device will now boot to Libreboot.

Installing Libreboot externally, with a SPI flash programmer {#installing_libreboot_externally}
------------------------------------------------------------

Before installing Libreboot to the SPI flash internally, the device has
to be opened.

The SPI flash is located next to the write protect screw. Its layout is
indicated in the picture below. Note that it is not necessary to connect
**WP\#** since removing the screw already connects it to ground. Before
writing to the chip externally, the battery connector has to be
detached. It is located under the heat spreader, that has to be
unscrewed from the rest of the case. The battery connector is located on
the right and has colorful cables, as shown on the picture below.

[![SPI flash
layout](images/c201/spi-flash-layout.jpg)](images/c201/spi-flash-layout.jpg)
[![Battery
connector](images/c201/battery-connector.jpg)](images/c201/battery-connector.jpg)

All the files from the **veyron\_speedy** release (or build) have to be
transferred to the host.

The following operations have to be executed with root privileges on the
host (e.g. using the *root* account). In addition, the
**cros-flash-replace** script has to be made executable:

    # chmod a+x cros-flash-replace

The SPI flash has to be read first (using the right spi programmer):

    # flashrom -p *programmer* -r flash.img
**Note: it might be a good idea to copy the produced flash.img file at
this point and store it outside of the device for backup purposes.**

Then, the **cros-flash-replace** script has to be executed as such:

    # ./cros-flash-replace flash.img coreboot ro-frid
If any error is shown, it is definitely a bad idea to go further than
this point.

The resulting flash image can then be flashed back (using the right spi
programmer):

    # flashrom -p *programmer* -w flash.img

You should also see within the output the following:\
**"Verifying flash\... VERIFIED."**

The device will now boot to Libreboot.

Installing Debian
---------------------
Debian is recommended for this device (which is on that list.

See <https://wiki.debian.org/InstallingDebianOn/Asus/C201>.

Copyright © 2015 Paul Kocialkowski <contact@paulk.fr>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)
